Lucene search
+L

46449 matches found

IBM Security Bulletins
IBM Security Bulletins
added 2026/08/22 3:47 p.m.6 views

Security Bulletin: MaaS360 mobile apps (iOS and Android) are able to bypass authentication by using deep link from the browser.

Summary MaaS360 mobile apps iOS and Android are able to bypass authentication by using deep link from the browser. Vulnerability Details CVEID:CVE-2023-42021 DESCRIPTION: The MaaS360 iOS application could allow an attacker to bypass authentication mechanisms by exploiting the password reset...

5.6AI score
SaveExploits0Affected Software1
CVE
CVE
added 2026/08/22 12:26 p.m.12 views

CVE-2026-62382

PasswordPusher versions v1.45.11 through v2.9.5 contain an improper authorization flaw in the push deletion logic. The ownership check compares @push.user against current_user; for anonymously created pushes both values are nil, and Ruby evaluates nil == nil as true, bypassing the deletable_by_vi...

6.9CVSS5.5AI score
SaveExploits0References2
EUVD
EUVD
added 2026/08/22 12:26 p.m.8 views

EUVD-2026-64266

AVideo through commit 9c39d8c8 contains an authentication bypass vulnerability where deduplicateByEncoderQueueId returns videoidhash credentials for any video by encoderqueueid without ownership verification, and useVideoHashOrLogin converts this hash into passwordless login as the video owner...

8.8CVSS5.5AI score
SaveExploits0References2
CVE
CVE
added 2026/08/22 12:26 p.m.16 views

CVE-2026-59808

AVideo (through commit 9c39d8c8) is affected by an authentication bypass vulnerability. The root cause lies in deduplicateByEncoderQueueId(), which returns video_id_hash credentials for any video by encoder_queue_id without ownership verification , and useVideoHashOrLogin(), which converts this h...

8.8CVSS5.5AI score
SaveExploits0References2
Nuclei
Nuclei
added 2026/08/22 12:19 p.m.11 views

LatePoint <= 5.0.12 - Authentication Bypass

LatePoint plugin for WordPress versions up to 5.0.12 contains an authentication bypass caused by insufficient verification of user during booking, letting unauthenticated attackers log in as any existing user if they have user ID access, exploit requires access to user ID, and the 'Use WordPress...

9.8CVSS5.3AI score0.0308EPSS
SaveExploits0References3
Nuclei
Nuclei
added 2026/08/22 12:19 p.m.43 views

SiYuan Note <= 3.6.5 - Authentication Bypass

SiYuan Note 3.6.5 and prior is vulnerable to authentication bypass. The CheckAuth middleware unconditionally trusted all chrome-extension:// origins, granting RoleAdministrator access without token validation to any request with a spoofed Origin header. Fixed in v3.7.0. id: CVE-2026-54069 info:...

9.2CVSS7.6AI score0.00623EPSS
SaveExploits0References2
Nuclei
Nuclei
added 2026/08/22 12:19 p.m.121 views

Versa Concerto API Path Based - Authentication Bypass

Authentication bypass in the Versa Concerto API, caused by URL decoding inconsistencies. It allowed unauthorized access to certain API endpoints by manipulating the URL path.This issue enabled attackers to bypass authentication controls and access restricted resources. id: CVE-2025-34027 info:...

10CVSS9.1AI score0.32337EPSS
SaveExploits0References4
Nuclei
Nuclei
added 2026/08/22 12:19 p.m.32 views

Four-Faith F3x36 - Authentication Bypass

Four-Faith F3x36 router with firmware v2.0.0 contains an authentication bypass caused by hard-coded credentials in the administrative web server, letting attackers with knowledge of credentials gain administrative access via crafted HTTP requests. id: CVE-2024-9643 info: name: Four-Faith F3x36 -...

9.8CVSS8.8AI score0.0298EPSS
SaveExploits0References2
Nuclei
Nuclei
added 2026/08/22 12:19 p.m.55 views

Etherpad Lite <1.6.4 - Admin Authentication Bypass

Etherpad Lite before 1.6.4 is exploitable for admin access. id: CVE-2018-9845 info: name: Etherpad Lite 1.6.4 - Admin Authentication Bypass author: philippedelteil severity: critical description: Etherpad Lite before 1.6.4 is exploitable for admin access. impact: | An attacker can bypass the admi...

9.8CVSS8.9AI score0.13132EPSS
SaveExploits0References5
Nuclei
Nuclei
added 2026/08/22 12:19 p.m.107 views

Masa CMS - Authentication Bypass

Masa CMS 7.2, 7.3, and 7.4-beta are susceptible to authentication bypass in the Remember Me function. An attacker can bypass authentication via a crafted web request and thereby obtain sensitive information, modify data, and/or execute unauthorized administrative operations in the context of the...

9.8CVSS8.8AI score0.06253EPSS
SaveExploits1References5
Nuclei
Nuclei
added 2026/08/22 12:19 p.m.90 views

HPE Edgeline Infrastructure Manager <1.22 - Authentication Bypass

HPE Edgeline Infrastructure Manager, also known as HPE Edgeline Infrastructure Management Software, prior to version 1.22 contains an authentication bypass vulnerability which could be remotely exploited to bypass remote authentication and possibly lead to execution of arbitrary commands, gaining...

10CVSS9.3AI score0.68293EPSS
SaveExploits1References5
Nuclei
Nuclei
added 2026/08/22 12:19 p.m.87 views

Zyxel NBG2105 V1.00(AAGU.2)C0 - Authentication Bypass

Zyxel NBG2105 V1.00AAGU.2C0 devices are susceptible to authentication bypass vulnerabilities because setting the login cookie to 1 provides administrator access. id: CVE-2021-3297 info: name: Zyxel NBG2105 V1.00AAGU.2C0 - Authentication Bypass author: gy741 severity: high description: Zyxel NBG21...

7.8CVSS7.6AI score0.20514EPSS
SaveExploits1References5
Nuclei
Nuclei
added 2026/08/22 12:19 p.m.87 views

TOTOLINK EX1200T 4.1.2cu.5215 - Authentication Bypass

TOTOLINK EX1200T 4.1.2cu.5215 is susceptible to authentication bypass. An attacker can bypass login by sending a specific request through formLoginAuth.htm, thus potentially being able to obtain sensitive information, modify data, and/or execute unauthorized operations. id: CVE-2021-42887 info:...

9.8CVSS8.9AI score0.44291EPSS
SaveExploits1References3
Nuclei
Nuclei
added 2026/08/22 12:19 p.m.22 views

Alumni Management System 1.0 - SQL Injection

SourceCodester Alumni Management System 1.0 contains a sqlinjection caused by unsanitized input in admin/login.php, letting attackers bypass authentication, exploit requires injection of malicious SQL payload. id: CVE-2020-29214 info: name: Alumni Management System 1.0 - SQL Injection author:...

9.8CVSS9.1AI score0.04499EPSS
SaveExploits1References2
Nuclei
Nuclei
added 2026/08/22 12:19 p.m.30 views

Canon Devices - Authentication Bypass in Catwalk Server

Certain Canon devices manufactured in 2012 through 2020 such as imageRUNNER ADVANCE iR-ADV C5250, when Catwalk Server is enabled for HTTP access, allow remote attackers to modify an e-mail address setting, and thus cause the device to send sensitive information through e-mail to the attacker. For...

7.5CVSS7.4AI score0.04EPSS
SaveExploits1References3
Nuclei
Nuclei
added 2026/08/22 12:19 p.m.40 views

Open WebUI 'LDAP Empty Password' - Authentication Bypass

Open WebUI is a self-hosted artificial intelligence platform designed to operate entirely offline. Prior to 0.9.0, the LDAP authentication endpoint does not validate that the submitted password is non-empty before performing a Simple Bind against the LDAP server. The LdapForm Pydantic model accep...

9.1CVSS8.5AI score0.01461EPSS
SaveExploits1References2
Nuclei
Nuclei
added 2026/08/22 12:19 p.m.36 views

Milvus - Unauthenticated Metrics API Access

Milvus 2.5.27 and 2.6.10 contains an authentication bypass caused by weak default token and unauthenticated REST API on TCP port 9091, letting attackers perform arbitrary expression evaluation and data manipulation, exploit requires network access to port 9091. id: CVE-2026-26190 info: name: Milv...

9.8CVSS8.9AI score0.36912EPSS
SaveExploits2References3
Nuclei
Nuclei
added 2026/08/22 12:19 p.m.5 views

User Profile Builder 3.16.4 - Unauthenticated Authentication Bypass

The User Profile Builder plugin for WordPress version 3.16.4 is vulnerable to an authentication bypass via type confusion. Profile Builder's automatic-login-after-registration handler passes the return value of wpinsertuser through absint before testing it with iswperror, so the error check runs...

9.8CVSS5.8AI score0.03452EPSS
SaveExploits4References6
Nuclei
Nuclei
added 2026/08/22 12:19 p.m.203 views

Nacos <1.4.1 - Authentication Bypass

Nacos before version 1.4.1 is vulnerable to authentication bypass because the ConfigOpsController lets the user perform management operations like querying the database or even wiping it out. While the /data/remove endpoint is properly protected with the @Secured annotation, the /derby endpoint i...

8.6CVSS7.4AI score0.65498EPSS
SaveExploits2References5
Nuclei
Nuclei
added 2026/08/22 12:19 p.m.54 views

Easy Digital Downloads - Privilege Escalation

Improper Authentication vulnerability in Easy Digital Downloads plugin allows unauth. Privilege Escalation. This issue affects Easy Digital Downloads: from 3.1 through 3.1.1.4.1. id: CVE-2023-30869 info: name: Easy Digital Downloads - Privilege Escalation author: daffainfo severity: critical...

9.8CVSS8.7AI score0.031EPSS
SaveExploits0References3
Rows per page
Query Builder